The implementation of fee-based video broadcasting requires a conventional conditional access (CA) system to prevent non-subscribers and unauthorized users from receiving signal broadcasts. A complete CA system usually includes three main functions: a scrambling/descrambling function, an entitlement control function, and an entitlement management function.
The scrambling/descrambling function is designed to make the program incomprehensible for unauthorized receivers. Scrambling can be applied commonly or separately to the different elementary stream components of a program. For example, the video, audio and data stream components of a TV program may be scrambled in order to make these streams unintelligible. Scrambling may be achieved by applying various scrambling algorithms to the stream components. The scrambling algorithm usually utilizes a secret key, called a control word. Once the signal is received, the descrambling can be achieved by any receiver that holds the secret key, or the control word, used by the scrambling algorithm prior to transmission. Scrambling and descrambling operations, in general, do not cause any impairment on the quality of the signals. The commonly used algorithms for scrambling digital data in CA systems are symmetric key ciphers. The control word used by the scrambling algorithm is a secret parameter known only by the scrambler and the authorized descramblers. In order to preserve the integrity of the encryption process, the control word has to be changed frequently in order to avoid any exhaustive searches by an unauthorized user which is intended to discover the control word.
The rights and associated keys needed to descramble a program are called entitlements. The entitlement control function provides the conditions required to access a scrambled program together with the encrypted secret parameters enabling the signal descrambling process for the authorized receivers. This data is broadcasted as conditional access messages, called entitlement control messages (ECMs). The ECMs carry an encrypted form of the control words, or a means to recover the control words, together with access parameters, such as an identification of the service and of the conditions required for accessing this service. Upon receipt of an ECM, the receiver transmits the encrypted control word and the access characteristics to the security device, for example, a smart card. After it has been confirmed that a user is authorized to watch the specific program, the security device checks the origin and integrity of the control word and the access parameters before decrypting the control word and sending it to the descrambler.
The entitlement management function is associated with distributing the entitlements to the receivers. There are several kinds of entitlements matching the different means to “buy” a video program. These entitlements are also broadcasted as conditional access messages, called entitlement management messages (EMMs). The EMMs are used to convey entitlements or keys to users, or to invalidate or delete entitlements or keys. The entitlement control functions and the entitlement management functions require the use of secret keys and cryptographic algorithms. For example, most modern conditional access systems utilize a smart card to store secret keys and to run cryptographic algorithms safely.
Most CA systems scramble and/or randomize transmitted data bits so that unauthorized decoders cannot decode the transmitted data bits. Authorized decoders are delivered a key that initializes the circuit that inverts the data bit randomization. As used herein, the term scrambling may be associated with the pseudo-random inversion of data bits based on a key that is valid for a short period of time. In addition to scrambling, a key may also be transformed into an encrypted key in order to protect it from any unauthorized users. From a cryptographic point of view, this transformation of the key to an encrypted key is the only part of the system that protects the data from a highly motivated pirate or a hacker. As a result, the scrambling portions of the process alone, in the absence of an key encryption, can be easily defeated. A CA system is usually associated with a system that implements key encryption and distribution of the encrypted key. The general requirements that a CA system with scrambling and encryption functionality must meet for digital video delivery are as follows: protection against signal piracy, efficient scrambling, flexibility, variety of supported formats, and ease of implementation.
With regard to robust protection against signal piracy, it must be difficult for a third party to perform unauthorized reception. In addition, the scrambled signal content must not be understandable. Efficient scrambling of all kinds of signals, as in multimedia broadcasts for example, must be possible and quality must not deteriorate (perceptibly) when these signals are being restored (quality signal restoration). A CA system is also flexible as it can be exercised on an elementary stream-by-stream basis, including the ability to selectively scramble bit streams in a program, if it is desired. Further, various business formats, such as multi-channel services and billing schemes, may be supported with low operating costs, and a private encryption system may be used, for example, by each program provider that is part of the CA system. A CA system with scrambling and encryption functionality may be implemented in standard consumer instruments, which also ensures cost effective receivers.
With either a conditional access system or a copy protection system, private (secure) keys are nearly always used for scrambling and descrambling high-value content or for protecting highly sensitive transactions. In a CA system, the content scrambling key must be protected. To ensure proper functionality, the CA system should perform scrambling according to the properties of the data for transmission. In addition, the CA system should change the key regularly to maintain the security of the scrambling system, and transmit the key information to the receiver in a secure manner using a hierarchical encryption system. Thirdly, for the purpose of operating fee-based broadcasting service, reception should be controlled according to the details of each users subscription.
Such CA system can be achieved in various ways depending on types of services, required functions, and security. FIG. 1 is a block diagram illustrating a conditional access system utilizing a conventional key ladder system. The configuration of the CA system 100 in FIG. 1 has been recommended by International Telecommunications Union-Radiocommunication Sector (ITU-R). Referring to FIG. 1, there is shown a block diagram of an exemplary conditional access system 100, which may include a scrambler 102, a descrambler 108, encryptors 104 and 106, decryptors 110 and 112, a switch 115, and a viewing enable/disable circuit 114. On the transmit side of the diagram, TX, the compressed audio/video signal 116 may be scrambled by the scrambler 102, utilizing a scrambling key Ks 118, in order to obtain a scrambled broadcast signal 128. Program attribute information 120 may be encrypted by the encryptor 104, utilizing a work key Kw 122, to obtain the entitlement control messages 130. Program subscription information 124 may be encrypted by the encryptor 106, utilizing a master key 126, to obtain the entitlement management messages 132.
During signal scrambling in the CA system 100, the scrambling key Ks 118 determines the scrambling pattern. It is common to change the scrambling key at fixed intervals of time, such as every few seconds, to maintain a secure system. The scrambling key 118 must, therefore, be continuously transmitted to the subscriber's receiver. This is achieved in the CA system 100 by encrypting the scrambling key 118 by the encryptor 104 and transmitting it within the entitlement control messages 130. The ECM 130 may also include the program attribute information 120. The program attribute information 120 may be utilized, for example, for determining whether a subscriber is entitled to view a program on the basis of his or her subscription. To prevent the ECM 130, which includes the scrambling key 118, from being understood by a third party, the ECM 130 is encrypted by the encryptor 104 before transmission, by utilizing the work key Kw 122. The work key 122 may be updated on a monthly or yearly basis. The work key 122 is sent to the receiver through the entitlement management messages 132, together with the subscription information 124. The subscription information 124 may also contain any subscription updates for the specific subscriber.
Besides broadcast wave, the EMM 132 may be transmitted out-of-band utilizing other media like the Internet, telephone lines, a signaling network, or a smart card. Prior to transmission, the EMM 132 is encrypted by a master key Km 126. A master key is unique to each receiver and its security must be commonly managed among different broadcast operators that use the same type of receiver. This can normally be accomplished by setting up an organization for uniform key management. For example, in the CA system 100 illustrated in FIG. 1, the content scrambling key 118 is protected by the work key 122, which is in turn protected by the master key 126. This key protection “chain” is, sometimes, referred to as a key ladder.
On the receive side of the diagram, RX, the same key ladder is utilized in order to decrypt the necessary secure keys and scrambled broadcast audio/video signals 128. The master key 126 may be utilized with the decryptor 112 in order to decrypt the EMM 132 and the work key 122. As a result, the work key 122 is obtained as one of the outputs from the decryptor 112. The decrypted work key 122 may then be utilized by the decryptor 110 in order to decrypt the ECM 130 and the scrambling key 118. As a result, the scrambling key 118 is obtained as one of the outputs from the decryptor 110. The decrypted scrambling key 118 may then be utilized by the descrambler 108 in order to descramble the scrambled broadcast signal 128 and obtain the compressed audio/video output 140.
Access to the compressed audio/video output 140 by a user is determined in accordance with the user's subscription information 124 and the program attribute information 120. The decryptor 112 decrypts the EMM 132 to obtain decrypted subscription information 125. The decryptor 110 decrypts the ECM 130 to obtain decrypted program attribute information 120. The viewing enable/disable module 114 receives the decrypted subscription information 125 and the decrypted program attribute information and may then determine whether or not a user is entitled to receive the compressed audio/video output 140. If the user is entitled to receive the compressed audio/video output 140 (for example, the user has a valid subscription for a given programming channel), then the viewing enable/disable module 114 issues a control signal 134 activating the switch 115. Once the switch 115 is activated, this allows for the decrypted scrambling key 118 to be entered into the descrambler 108, which in turn allows for the descrambling of the compressed audio/video output 140.
FIG. 2 is a block diagram illustrating secure key unwrapping in a conventional key ladder system. Referring to FIG. 2, the key ladder system 200 may comprise a one time programmable (OTP) memory 202, a secure key generating module 204 and a key unwrapping module 206. The key unwrapping module 206 may comprise scramblers 208, 210, 212 and 214. Each of the scramblers 208, 210, 212 and 214 may utilize a symmetric encryption algorithm, for example a Data Encryption Standard (DES), a 3DES or an Advanced Encryption Standard (AES) type of algorithm, in order to descramble an encrypted key input. The OTP memory 202 in the key ladder system 200 may be adapted to store a root key, for example a key such as the master key 126 in FIG. 1. The root key stored in the OTP memory 202 may be further protected by the secure key generating module 204. The secure key generating module 204 may comprise suitable logic, circuitry and/or code that may be adapted to scramble, or otherwise further enhance the security of the root key stored in the OTP memory 202.
The key unwrapping module 206 may be adapted to “unwrap”, or descramble, various application keys, for example, application key 1, 228, and application key 2, 230. In order to achieve this, the key unwrapping module 206 may utilize several encrypted keys, for example, encrypted key 1, 216, encrypted key 2, 218, encrypted key 3, 220, and encrypted key 4, 222. Once the root key stored in the OTP memory 202 is scrambled by the secure key generating module 204, the scrambled root key 205 may be utilized by the scrambler 208 in order to decrypt the encrypted key 1, 216, and obtain a decrypted key 224. The decrypted key 224 may comprise, for example, a work key. The decrypted key 224 may be utilized by the scrambler 210 in order to decrypt encrypted key 2, 218, and obtain the decrypted key 226. The decrypted key 226 may comprise, for example, a scrambling key.
The decrypted key 226 may be utilized by the scrambler 212 in order to decrypt encrypted key 3, 220, and obtain the decrypted application key 1, 228. Similarly, the decrypted application key 228 may be utilized by the scrambler 214 in order to decrypt encrypted key 4, 222, and obtain the decrypted application key 2, 230. Decrypted application keys 228 and 230 may be further utilized for various functions, for example, for copy protection of broadcast signals. The key ladder in the key unwrapping module 206 may be adapted to have varying levels of protection by increasing the number of the encrypted keys and the corresponding scramblers, and by utilizing each previously decrypted application key in a subsequent decryption of a following encrypted key. The key ladder may be utilized to “unwrap” a master key, a work key and a scrambling key. The master key, work key and scrambling key may then be utilized to decrypt one or more application keys.
Even though the key unwrapping module 206 may provide increasing level of protection by increasing the number of scramblers and encrypted keys it may be difficult to determine whether or not the received encrypted keys in the key ladder system 200 of FIG. 2 have been manipulated by unauthorized parties.
When encrypted data is transmitted over an insecure channel, the transmitting and/or the receiving party may need the ability to monitor such communication and obtain verification of the identity of the other party, and of the integrity and origin of the encrypted data that was transmitted. Referring now to FIG. 3, there is illustrated a flow diagram of a method 300 for conventional digital signature generation and verification process utilizing public key encryption. A transmitting entity may create a signature on a message 301 prior to transmission of the message.
In general, a signature s of a message m may be computed, for example, by applying an algorithm represented by the relationship s=SA(m), where SA is a signing function for the message m. Prior to creating the signature, the outgoing message 301 may be compressed by a compression algorithm 303. The compression algorithm 303 may be, for example, a secure hash algorithm. A digital signature algorithm 307 may then be applied to the compressed message or message digest 305. The digital signature algorithm may utilize a private key 309 in order to generate the digital signature 311. After generating the signature s, the pair (s;m) may be transmitted. The digital signature 311 may then be transmitted together with the message digest 305.
A receiving entity may then receive the digital signature 311 and the message digest 305 in a form of a received message 313. The receiving entity may then apply the same decompression algorithm used by the transmitting entity on the message 301. For example, a secure hash algorithm 315 may be applied in order to decompress the received message 313 and obtain the message digest 317. In order for the receiving entity to verify that the digital signature 311 on the received message 313 was created by the transmitting entity and not by a third outside party, a verification algorithm 319 may be applied to the message digest 317.
In general, to verify that a signature s on a message m was created by a transmitting entity A, a receiving entity B, referenced to as a verifier, may obtain the verification function VA of A and may compute a result u from applying the verification function, where the result u may be represented by the relationship u=VA(m, s). The signature s may be authenticated as created by A if u=true, and the signature may be rejected as unauthorized if u=false.
Similarly, the verification algorithm 319 may utilize a public key 321 together with the message digest 317 in order to authenticate the digital signature 311. If the result of the verification operation 323 is true, the digital signature 311 is authenticated, and if the result 323 is false, the digital signature 311 may be rejected as unauthorized.
There are several properties that may be required of the signing and verification functions, 307 and 319, respectively. The digital signature 311 is a valid signature of the message digest 305 if and only if the verification function 319 returns a true result. In addition, the signing function 307 and the verification function 319 are selected so that it is computationally infeasible for any entity, other than the transmitting and the receiving entities, to find, for any incoming message digest, a digital signature such that the verification function returns a true result.
FIG. 4 is a block diagram illustrating a conventional secure system for signature verification utilizing public key encryption. The conventional secure system 400 may comprise a transmitting entity A 402 and a receiving entity B 404. Entity A 402 may “sign” the message m 414 by first applying an encryption algorithm 406 to the message m, yielding signature s 416. The encryption algorithm 406 may comprise an asymmetric encryption algorithm EeA(s), such as a public key encryption algorithm, in order to encrypt, or sign, the message m. The transmitting entity A 402 may then encrypt the signature s 416 by applying an encryption algorithm 408 to the signature s, yielding encrypted signed message c 421. The encryption algorithm 408 may comprise a symmetric encryption algorithm of the receiving entity B, EeB(s), in order to encrypt the signature s 416. The encrypted signed message c 421 may then be transmitted over an unsecured public channel 422, where it may be exposed to attacks by an attacker 424.
After the receiving entity B 404 receives the encrypted signed message c 421, a decryption algorithm 410 may be applied to the encrypted signed message c 421 to obtain the decrypted signature s 418. The decryption algorithm 410 may comprise a symmetric encryption algorithm of the receiving entity B, DdB(c), in order to decrypt the encrypted signed message c 421 to obtain the decrypted signature s 418. The signature s 418 may then be further decrypted, or verified, by the decryption algorithm 412 to obtain the decrypted message m 420. The decryption algorithm 412 may comprise an asymmetric encryption algorithm DdA(m), in order to verify the signature s 418 and obtain the decrypted and verified message m 420. If the resulting message m 420 is an intelligible message, it may be concluded that the message m 420 must have been initiated by the transmitting entity A 402, since no one else could have known A's secret decryption key eA to form the signature s 416.
Further limitations and disadvantages of conventional and traditional approaches will become apparent to one of skill in the art, through comparison of such systems with some aspects of the present invention as set forth in the remainder of the present application with reference to the drawings.